git.sur5r.net Git - openldap/blob - servers/slapd/bind.c

   1 /* bind.c - decode an ldap bind operation and pass it to a backend db */
   2 /* $OpenLDAP$ */
   3 /*
   4  * Copyright 1998-2002 The OpenLDAP Foundation, All Rights Reserved.
   5  * COPYING RESTRICTIONS APPLY, see COPYRIGHT file
   6  */
   7
   8 /*
   9  * Copyright (c) 1995 Regents of the University of Michigan.
  10  * All rights reserved.
  11  *
  12  * Redistribution and use in source and binary forms are permitted
  13  * provided that this notice is preserved and that due credit is given
  14  * to the University of Michigan at Ann Arbor. The name of the University
  15  * may not be used to endorse or promote products derived from this
  16  * software without specific prior written permission. This software
  17  * is provided ``as is'' without express or implied warranty.
  18  */
  19
  20 #include "portable.h"
  21
  22 #include <stdio.h>
  23
  24 #include <ac/string.h>
  25 #include <ac/socket.h>
  26
  27 #include "ldap_pvt.h"
  28 #include "slap.h"
  29
  30 int
  31 do_bind(
  32     Connection  *conn,
  33     Operation   *op
  34 )
  35 {
  36         BerElement *ber = op->o_ber;
  37         ber_int_t version;
  38         ber_tag_t method;
  39         struct berval mech = { 0, NULL };
  40         struct berval dn = { 0, NULL };
  41         struct berval pdn = { 0, NULL };
  42         struct berval ndn = { 0, NULL };
  43         struct berval edn = { 0, NULL };
  44         ber_tag_t tag;
  45         int     rc = LDAP_SUCCESS;
  46         const char *text;
  47         struct berval cred = { 0, NULL };
  48         Backend *be = NULL;
  49
  50 #ifdef NEW_LOGGING
  51         LDAP_LOG( OPERATION, ENTRY, "do_bind: conn %d\n", conn->c_connid, 0, 0 );
  52 #else
  53         Debug( LDAP_DEBUG_TRACE, "do_bind\n", 0, 0, 0 );
  54 #endif
  55
  56         /*
  57          * Force to connection to "anonymous" until bind succeeds.
  58          */
  59         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
  60         if ( conn->c_sasl_bind_in_progress ) be = conn->c_authz_backend;
  61
  62         /* log authorization identity demotion */
  63         if ( conn->c_dn.bv_len ) {
  64                 Statslog( LDAP_DEBUG_STATS,
  65                         "conn=%lu op=%lu AUTHZ anonymous mech=implicit ssf=0",
  66                         op->o_connid, op->o_opid, 0, 0, 0 );
  67         }
  68
  69         connection2anonymous( conn );
  70         if ( conn->c_sasl_bind_in_progress ) conn->c_authz_backend = be;
  71         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
  72
  73         if ( op->o_dn.bv_val != NULL ) {
  74                 free( op->o_dn.bv_val );
  75                 op->o_dn.bv_val = ch_strdup( "" );
  76                 op->o_dn.bv_len = 0;
  77         }
  78
  79         if ( op->o_ndn.bv_val != NULL ) {
  80                 free( op->o_ndn.bv_val );
  81                 op->o_ndn.bv_val = ch_strdup( "" );
  82                 op->o_ndn.bv_len = 0;
  83         }
  84
  85         /*
  86          * Parse the bind request.  It looks like this:
  87          *
  88          *      BindRequest ::= SEQUENCE {
  89          *              version         INTEGER,                 -- version
  90          *              name            DistinguishedName,       -- dn
  91          *              authentication  CHOICE {
  92          *                      simple          [0] OCTET STRING -- passwd
  93          *                      krbv42ldap      [1] OCTET STRING
  94          *                      krbv42dsa       [2] OCTET STRING
  95          *                      SASL            [3] SaslCredentials
  96          *              }
  97          *      }
  98          *
  99          *      SaslCredentials ::= SEQUENCE {
 100      *          mechanism           LDAPString,
 101      *          credentials         OCTET STRING OPTIONAL
 102          *      }
 103          */
 104
 105         tag = ber_scanf( ber, "{imt" /*}*/, &version, &dn, &method );
 106
 107         if ( tag == LBER_ERROR ) {
 108 #ifdef NEW_LOGGING
 109                 LDAP_LOG( OPERATION, ERR,
 110                         "do_bind: conn %d  ber_scanf failed\n", conn->c_connid, 0, 0 );
 111 #else
 112                 Debug( LDAP_DEBUG_ANY, "bind: ber_scanf failed\n", 0, 0, 0 );
 113 #endif
 114                 send_ldap_disconnect( conn, op,
 115                         LDAP_PROTOCOL_ERROR, "decoding error" );
 116                 rc = -1;
 117                 goto cleanup;
 118         }
 119
 120         op->o_protocol = version;
 121
 122         if( method != LDAP_AUTH_SASL ) {
 123                 tag = ber_scanf( ber, /*{*/ "m}", &cred );
 124
 125         } else {
 126                 tag = ber_scanf( ber, "{o" /*}*/, &mech );
 127
 128                 if ( tag != LBER_ERROR ) {
 129                         ber_len_t len;
 130                         tag = ber_peek_tag( ber, &len );
 131
 132                         if ( tag == LDAP_TAG_LDAPCRED ) {
 133                                 tag = ber_scanf( ber, "m", &cred );
 134                         } else {
 135                                 tag = LDAP_TAG_LDAPCRED;
 136                                 cred.bv_val = NULL;
 137                                 cred.bv_len = 0;
 138                         }
 139
 140                         if ( tag != LBER_ERROR ) {
 141                                 tag = ber_scanf( ber, /*{{*/ "}}" );
 142                         }
 143                 }
 144         }
 145
 146         if ( tag == LBER_ERROR ) {
 147                 send_ldap_disconnect( conn, op,
 148                         LDAP_PROTOCOL_ERROR,
 149                 "decoding error" );
 150                 rc = SLAPD_DISCONNECT;
 151                 goto cleanup;
 152         }
 153
 154         if( (rc = get_ctrls( conn, op, 1 )) != LDAP_SUCCESS ) {
 155 #ifdef NEW_LOGGING
 156                 LDAP_LOG( OPERATION, INFO,
 157                         "do_bind: conn %d  get_ctrls failed\n", conn->c_connid, 0, 0 );
 158 #else
 159                 Debug( LDAP_DEBUG_ANY, "do_bind: get_ctrls failed\n", 0, 0, 0 );
 160 #endif
 161                 goto cleanup;
 162         }
 163
 164         rc = dnPrettyNormal( NULL, &dn, &pdn, &ndn );
 165         if ( rc != LDAP_SUCCESS ) {
 166 #ifdef NEW_LOGGING
 167                 LDAP_LOG( OPERATION, INFO,
 168                         "do_bind: conn %d  invalid dn (%s)\n",
 169                         conn->c_connid, dn.bv_val, 0 );
 170 #else
 171                 Debug( LDAP_DEBUG_ANY, "bind: invalid dn (%s)\n",
 172                         dn.bv_val, 0, 0 );
 173 #endif
 174                 send_ldap_result( conn, op, rc = LDAP_INVALID_DN_SYNTAX, NULL,
 175                     "invalid DN", NULL, NULL );
 176                 goto cleanup;
 177         }
 178
 179         if( method == LDAP_AUTH_SASL ) {
 180 #ifdef NEW_LOGGING
 181                 LDAP_LOG( OPERATION,     DETAIL1,
 182                         "do_sasl_bind: conn %d  dn (%s) mech %s\n",
 183                         conn->c_connid, pdn.bv_val, mech.bv_val );
 184 #else
 185                 Debug( LDAP_DEBUG_TRACE, "do_sasl_bind: dn (%s) mech %s\n",
 186                         pdn.bv_val, mech.bv_val, NULL );
 187 #endif
 188
 189         } else {
 190 #ifdef NEW_LOGGING
 191                 LDAP_LOG( OPERATION, DETAIL1,
 192                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 193                         (unsigned long) version, pdn.bv_val, (unsigned long)method );
 194 #else
 195                 Debug( LDAP_DEBUG_TRACE,
 196                         "do_bind: version=%ld dn=\"%s\" method=%ld\n",
 197                         (unsigned long) version,
 198                         pdn.bv_val, (unsigned long) method );
 199 #endif
 200         }
 201
 202         Statslog( LDAP_DEBUG_STATS, "conn=%lu op=%lu BIND dn=\"%s\" method=%ld\n",
 203             op->o_connid, op->o_opid, pdn.bv_val, (unsigned long) method, 0 );
 204
 205         if ( version < LDAP_VERSION_MIN || version > LDAP_VERSION_MAX ) {
 206 #ifdef NEW_LOGGING
 207                 LDAP_LOG( OPERATION, INFO,
 208                         "do_bind: conn %d  unknown version = %ld\n",
 209                         conn->c_connid, (unsigned long)version, 0 );
 210 #else
 211                 Debug( LDAP_DEBUG_ANY, "do_bind: unknown version=%ld\n",
 212                         (unsigned long) version, 0, 0 );
 213 #endif
 214                 send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
 215                         NULL, "requested protocol version not supported", NULL, NULL );
 216                 goto cleanup;
 217
 218         } else if (!( global_allows & SLAP_ALLOW_BIND_V2 ) &&
 219                 version < LDAP_VERSION3 )
 220         {
 221                 send_ldap_result( conn, op, rc = LDAP_PROTOCOL_ERROR,
 222                         NULL, "requested protocol version not allowed", NULL, NULL );
 223                 goto cleanup;
 224         }
 225
 226         /* we set connection version regardless of whether bind succeeds
 227          * or not.
 228          */
 229         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 230         conn->c_protocol = version;
 231         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 232
 233         /* check for inappropriate controls */
 234         if( get_manageDSAit( op ) == SLAP_CRITICAL_CONTROL ) {
 235                 send_ldap_result( conn, op,
 236                         rc = LDAP_UNAVAILABLE_CRITICAL_EXTENSION,
 237                         NULL, "manageDSAit control inappropriate",
 238                         NULL, NULL );
 239                 goto cleanup;
 240         }
 241
 242         /* Set the bindop for the benefit of in-directory SASL lookups */
 243         conn->c_sasl_bindop = op;
 244
 245         if ( method == LDAP_AUTH_SASL ) {
 246                 slap_ssf_t ssf = 0;
 247
 248                 if ( version < LDAP_VERSION3 ) {
 249 #ifdef NEW_LOGGING
 250                         LDAP_LOG( OPERATION, INFO,
 251                                 "do_bind: conn %d  sasl with LDAPv%ld\n",
 252                                 conn->c_connid, (unsigned long)version , 0 );
 253 #else
 254                         Debug( LDAP_DEBUG_ANY, "do_bind: sasl with LDAPv%ld\n",
 255                                 (unsigned long) version, 0, 0 );
 256 #endif
 257                         send_ldap_disconnect( conn, op,
 258                                 LDAP_PROTOCOL_ERROR, "SASL bind requires LDAPv3" );
 259                         rc = SLAPD_DISCONNECT;
 260                         goto cleanup;
 261                 }
 262
 263                 if( mech.bv_len == 0 ) {
 264 #ifdef NEW_LOGGING
 265                         LDAP_LOG( OPERATION, INFO,
 266                                    "do_bind: conn %d  no SASL mechanism provided\n",
 267                                    conn->c_connid, 0, 0 );
 268 #else
 269                         Debug( LDAP_DEBUG_ANY,
 270                                 "do_bind: no sasl mechanism provided\n",
 271                                 0, 0, 0 );
 272 #endif
 273                         send_ldap_result( conn, op, rc = LDAP_AUTH_METHOD_NOT_SUPPORTED,
 274                                 NULL, "no SASL mechanism provided", NULL, NULL );
 275                         goto cleanup;
 276                 }
 277
 278                 /* check restrictions */
 279                 rc = backend_check_restrictions( NULL, conn, op, &mech, &text );
 280                 if( rc != LDAP_SUCCESS ) {
 281                         send_ldap_result( conn, op, rc,
 282                                 NULL, text, NULL, NULL );
 283                         goto cleanup;
 284                 }
 285
 286                 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 287                 if ( conn->c_sasl_bind_in_progress ) {
 288                         if( !bvmatch( &conn->c_sasl_bind_mech, &mech ) ) {
 289                                 /* mechanism changed between bind steps */
 290                                 slap_sasl_reset(conn);
 291                         }
 292                 } else {
 293                         conn->c_sasl_bind_mech = mech;
 294                         mech.bv_val = NULL;
 295                         mech.bv_len = 0;
 296                 }
 297                 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 298
 299                 rc = slap_sasl_bind( conn, op,
 300                         &pdn, &ndn,
 301                         &cred, &edn, &ssf );
 302
 303                 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 304                 if( rc == LDAP_SUCCESS ) {
 305                         conn->c_dn = edn;
 306                         if( edn.bv_len != 0 ) {
 307                                 /* edn is always normalized already */
 308                                 ber_dupbv( &conn->c_ndn, &conn->c_dn );
 309                         }
 310                         conn->c_authmech = conn->c_sasl_bind_mech;
 311                         conn->c_sasl_bind_mech.bv_val = NULL;
 312                         conn->c_sasl_bind_mech.bv_len = 0;
 313                         conn->c_sasl_bind_in_progress = 0;
 314
 315                         conn->c_sasl_ssf = ssf;
 316                         if( ssf > conn->c_ssf ) {
 317                                 conn->c_ssf = ssf;
 318                         }
 319
 320                         if( conn->c_dn.bv_len != 0 ) {
 321                                 ber_len_t max = sockbuf_max_incoming_auth;
 322                                 ber_sockbuf_ctrl( conn->c_sb,
 323                                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 324                         }
 325
 326                         /* log authorization identity */
 327                         Statslog( LDAP_DEBUG_STATS,
 328                                 "conn=%lu op=%lu AUTHZ dn=\"%s\" mech=%s ssf=%d\n",
 329                                 op->o_connid, op->o_opid,
 330                                 conn->c_dn.bv_val, conn->c_authmech.bv_val, ssf );
 331
 332 #ifdef NEW_LOGGING
 333                         LDAP_LOG( OPERATION, DETAIL1,
 334                                 "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
 335                                 conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
 336 #else
 337                         Debug( LDAP_DEBUG_TRACE,
 338                                 "do_bind: SASL/%s bind: dn=\"%s\" ssf=%d\n",
 339                                 conn->c_authmech.bv_val, conn->c_dn.bv_val, ssf );
 340 #endif
 341
 342                 } else if ( rc == LDAP_SASL_BIND_IN_PROGRESS ) {
 343                         conn->c_sasl_bind_in_progress = 1;
 344
 345                 } else {
 346                         if ( conn->c_sasl_bind_mech.bv_val ) {
 347                                 free( conn->c_sasl_bind_mech.bv_val );
 348                                 conn->c_sasl_bind_mech.bv_val = NULL;
 349                                 conn->c_sasl_bind_mech.bv_len = 0;
 350                         }
 351                         conn->c_sasl_bind_in_progress = 0;
 352                 }
 353                 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 354
 355                 goto cleanup;
 356
 357         } else {
 358                 /* Not SASL, cancel any in-progress bind */
 359                 ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 360
 361                 if ( conn->c_sasl_bind_mech.bv_val != NULL ) {
 362                         free(conn->c_sasl_bind_mech.bv_val);
 363                         conn->c_sasl_bind_mech.bv_val = NULL;
 364                         conn->c_sasl_bind_mech.bv_len = 0;
 365                 }
 366                 conn->c_sasl_bind_in_progress = 0;
 367
 368                 slap_sasl_reset( conn );
 369                 ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 370         }
 371
 372         if ( method == LDAP_AUTH_SIMPLE ) {
 373                 /* accept "anonymous" binds */
 374                 if ( cred.bv_len == 0 || ndn.bv_len == 0 ) {
 375                         rc = LDAP_SUCCESS;
 376                         text = NULL;
 377
 378                         if( cred.bv_len &&
 379                                 !( global_allows & SLAP_ALLOW_BIND_ANON_CRED ))
 380                         {
 381                                 /* cred is not empty, disallow */
 382                                 rc = LDAP_INVALID_CREDENTIALS;
 383
 384                         } else if ( ndn.bv_len &&
 385                                 !( global_allows & SLAP_ALLOW_BIND_ANON_DN ))
 386                         {
 387                                 /* DN is not empty, disallow */
 388                                 rc = LDAP_UNWILLING_TO_PERFORM;
 389                                 text = "unwilling to allow anonymous bind with non-empty DN";
 390
 391                         } else if ( global_disallows & SLAP_DISALLOW_BIND_ANON ) {
 392                                 /* disallow */
 393                                 rc = LDAP_INAPPROPRIATE_AUTH;
 394                                 text = "anonymous bind disallowed";
 395
 396                         } else {
 397                                 rc = backend_check_restrictions( NULL, conn, op,
 398                                         &mech, &text );
 399                         }
 400
 401                         /*
 402                          * we already forced connection to "anonymous",
 403                          * just need to send success
 404                          */
 405                         send_ldap_result( conn, op, rc,
 406                                 NULL, text, NULL, NULL );
 407 #ifdef NEW_LOGGING
 408                         LDAP_LOG( OPERATION, DETAIL1,
 409                                    "do_bind: conn %d  v%d anonymous bind\n",
 410                                    conn->c_connid, version , 0 );
 411 #else
 412                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d anonymous bind\n",
 413                                 version, 0, 0 );
 414 #endif
 415                         goto cleanup;
 416
 417                 } else if ( global_disallows & SLAP_DISALLOW_BIND_SIMPLE ) {
 418                         /* disallow simple authentication */
 419                         rc = LDAP_UNWILLING_TO_PERFORM;
 420                         text = "unwilling to perform simple authentication";
 421
 422                         send_ldap_result( conn, op, rc,
 423                                 NULL, text, NULL, NULL );
 424 #ifdef NEW_LOGGING
 425                         LDAP_LOG( OPERATION, INFO,
 426                                    "do_bind: conn %d  v%d simple bind(%s) disallowed\n",
 427                                    conn->c_connid, version, ndn.bv_val );
 428 #else
 429                         Debug( LDAP_DEBUG_TRACE,
 430                                 "do_bind: v%d simple bind(%s) disallowed\n",
 431                                 version, ndn.bv_val, 0 );
 432 #endif
 433                         goto cleanup;
 434
 435                 } else if (( global_disallows & SLAP_DISALLOW_BIND_SIMPLE_UNPROTECTED )
 436                         && ( op->o_ssf <= 1 ))
 437                 {
 438                         rc = LDAP_CONFIDENTIALITY_REQUIRED;
 439                         text = "unwilling to perform simple authentication "
 440                                 "without confidentilty protection";
 441
 442                         send_ldap_result( conn, op, rc,
 443                                 NULL, text, NULL, NULL );
 444
 445 #ifdef NEW_LOGGING
 446                         LDAP_LOG( OPERATION, INFO, "do_bind: conn %d  "
 447                                 "v%d unprotected simple bind(%s) disallowed\n",
 448                                 conn->c_connid, version, ndn.bv_val );
 449 #else
 450                         Debug( LDAP_DEBUG_TRACE,
 451                                 "do_bind: v%d unprotected simple bind(%s) disallowed\n",
 452                                 version, ndn.bv_val, 0 );
 453 #endif
 454                         goto cleanup;
 455                 }
 456
 457 #ifdef LDAP_API_FEATURE_X_OPENLDAP_V2_KBIND
 458         } else if ( method == LDAP_AUTH_KRBV41 || method == LDAP_AUTH_KRBV42 ) {
 459                 if ( global_disallows & SLAP_DISALLOW_BIND_KRBV4 ) {
 460                         /* disallow simple authentication */
 461                         rc = LDAP_UNWILLING_TO_PERFORM;
 462                         text = "unwilling to perform Kerberos V4 bind";
 463
 464                         send_ldap_result( conn, op, rc,
 465                                 NULL, text, NULL, NULL );
 466 #ifdef NEW_LOGGING
 467                         LDAP_LOG( OPERATION, DETAIL1,
 468                                    "do_bind: conn %d  v%d Kerberos V4 bind\n",
 469                                    conn->c_connid, version , 0 );
 470 #else
 471                         Debug( LDAP_DEBUG_TRACE, "do_bind: v%d Kerberos V4 bind\n",
 472                                 version, 0, 0 );
 473 #endif
 474                         goto cleanup;
 475                 }
 476 #endif
 477
 478         } else {
 479                 rc = LDAP_AUTH_METHOD_NOT_SUPPORTED;
 480                 text = "unknown authentication method";
 481
 482                 send_ldap_result( conn, op, rc,
 483                         NULL, text, NULL, NULL );
 484 #ifdef NEW_LOGGING
 485                 LDAP_LOG( OPERATION, INFO,
 486                            "do_bind: conn %ld  v%d unknown authentication method (%ld)\n",
 487                            conn->c_connid, version, method );
 488 #else
 489                 Debug( LDAP_DEBUG_TRACE,
 490                         "do_bind: v%d unknown authentication method (%ld)\n",
 491                         version, method, 0 );
 492 #endif
 493                 goto cleanup;
 494         }
 495
 496         /*
 497          * We could be serving multiple database backends.  Select the
 498          * appropriate one, or send a referral to our "referral server"
 499          * if we don't hold it.
 500          */
 501
 502         if ( (be = select_backend( &ndn, 0, 0 )) == NULL ) {
 503                 if ( default_referral ) {
 504                         BerVarray ref = referral_rewrite( default_referral,
 505                                 NULL, &pdn, LDAP_SCOPE_DEFAULT );
 506
 507                         send_ldap_result( conn, op, rc = LDAP_REFERRAL,
 508                                 NULL, NULL, ref ? ref : default_referral, NULL );
 509
 510                         ber_bvarray_free( ref );
 511
 512                 } else {
 513                         /* noSuchObject is not allowed to be returned by bind */
 514                         send_ldap_result( conn, op, rc = LDAP_INVALID_CREDENTIALS,
 515                                 NULL, NULL, NULL, NULL );
 516                 }
 517
 518                 goto cleanup;
 519         }
 520
 521         /* check restrictions */
 522         rc = backend_check_restrictions( be, conn, op, NULL, &text );
 523         if( rc != LDAP_SUCCESS ) {
 524                 send_ldap_result( conn, op, rc,
 525                         NULL, text, NULL, NULL );
 526                 goto cleanup;
 527         }
 528
 529         if ( be->be_bind ) {
 530                 int ret;
 531
 532                 /* deref suffix alias if appropriate */
 533                 suffix_alias( be, &ndn );
 534
 535                 ret = (*be->be_bind)( be, conn, op,
 536                         &pdn, &ndn, method, &cred, &edn );
 537
 538                 if ( ret == 0 ) {
 539                         ldap_pvt_thread_mutex_lock( &conn->c_mutex );
 540
 541                         if( conn->c_authz_backend == NULL ) {
 542                                 conn->c_authz_backend = be;
 543                         }
 544
 545                         if(edn.bv_len) {
 546                                 conn->c_dn = edn;
 547                         } else {
 548                                 conn->c_dn = pdn;
 549                                 pdn.bv_val = NULL;
 550                                 pdn.bv_len = 0;
 551                         }
 552
 553                         conn->c_ndn = ndn;
 554                         ndn.bv_val = NULL;
 555                         ndn.bv_len = 0;
 556
 557                         if( conn->c_dn.bv_len != 0 ) {
 558                                 ber_len_t max = sockbuf_max_incoming_auth;
 559                                 ber_sockbuf_ctrl( conn->c_sb,
 560                                         LBER_SB_OPT_SET_MAX_INCOMING, &max );
 561                         }
 562
 563                         /* log authorization identity */
 564                         Statslog( LDAP_DEBUG_STATS,
 565                                 "conn=%lu op=%lu AUTHZ dn=\"%s\" mech=simple ssf=0\n",
 566                                 op->o_connid, op->o_opid,
 567                                 conn->c_dn.bv_val, conn->c_authmech.bv_val, 0 );
 568
 569 #ifdef NEW_LOGGING
 570                         LDAP_LOG( OPERATION, DETAIL1,
 571                                 "do_bind: v%d bind: \"%s\" to \"%s\" \n",
 572                                 version, conn->c_dn.bv_val, conn->c_dn.bv_val );
 573 #else
 574                         Debug( LDAP_DEBUG_TRACE,
 575                                 "do_bind: v%d bind: \"%s\" to \"%s\"\n",
 576                                 version, dn.bv_val, conn->c_dn.bv_val );
 577 #endif
 578
 579                         ldap_pvt_thread_mutex_unlock( &conn->c_mutex );
 580
 581                         /* send this here to avoid a race condition */
 582                         send_ldap_result( conn, op, LDAP_SUCCESS,
 583                                 NULL, NULL, NULL, NULL );
 584
 585                 } else if (edn.bv_val != NULL) {
 586                         free( edn.bv_val );
 587                 }
 588
 589         } else {
 590                 send_ldap_result( conn, op, rc = LDAP_UNWILLING_TO_PERFORM,
 591                         NULL, "operation not supported within namingContext",
 592                         NULL, NULL );
 593         }
 594
 595 cleanup:
 596         conn->c_sasl_bindop = NULL;
 597
 598         if( pdn.bv_val != NULL ) {
 599                 free( pdn.bv_val );
 600         }
 601         if( ndn.bv_val != NULL ) {
 602                 free( ndn.bv_val );
 603         }
 604         if ( mech.bv_val != NULL ) {
 605                 free( mech.bv_val );
 606         }
 607
 608         return rc;
 609 }